Entities linked to Iran have moved over $3.84 billion in cryptocurrency through CoinEx since 2019, according to blockchain investigators such as TRM Labs. This amount makes CoinEx one of the main suspected channels for moving funds around U.S. sanctions on Iran. The transactions involve wallets linked to Iranian users, the country’s largest domestic exchange, and accounts that regulators have previously connected to sanctioned networks.
The Wall Street Journal reports that investigators noticed unusual activity this year from wallets linked to Nobitex, a major Iranian trading platform. TRM Labs says that Iran-linked wallets have used CoinEx extensively over the years, and that activity increased after U.S. authorities began monitoring Binance more closely. The 3.84 billion dollar figure covers about seven years and is based on address-linking methods, not formal ownership records.
Earlier in the year, investigators also traced suspicious movements tied to two digital wallets controlled by the Central Bank of Iran and linked them to part of the roughly $1.5 billion stolen from Bybit by North Korean hackers in what some call the largest crypto theft to date. The funds passed through multiple addresses before reaching central bank–linked wallets and then moving on to CoinEx.
U.S. officials and blockchain analytics firms previously attributed the Bybit exploit to North Korean actors, including the Lazarus Group, and investigators told the Journal that the same rails that laundered those hacked assets also appear to facilitate Iran’s movement of money outside the traditional banking system, potentially funding international transactions that U.S. sanctions would normally block.
CoinEx Response and Regulatory Questions
CoinEx has not faced new U.S. sanctions over the WSJ story, but regulators and compliance teams are now scrutinizing the exchange more closely. The company denies any relationship with the Iranian government, disputes how some wallets were labeled as Iran‑linked, and has reportedly begun blocking users in Iran while reviewing transactions tied to funds from the Bybit hack.
Analysis cited in the report also suggests CoinEx wallets interacted with addresses linked to Iran’s Islamic Revolutionary Guard Corps, including entities accused of oil sales and sanctions‑evasion activity. Those connections sharpen concerns about whether current KYC and AML controls at mid‑tier offshore exchanges are strong enough when nation‑states and sanctioned groups rely on crypto rails.
READ MORE: AAVE Price Jumps 16% After Standard Chartered Sets $3,500 Target
